The vulnerability is due to the improper file execution operations in the kernel mode. Security researchers from Kaspersky uncovered the zero-day vulnerability and it has been reported to Microsoft on October 29, 2018, and Microsoft patched with December security update.

A number of APT groups use the exploit including FruityArmor, CHAINSHOT, and the newly discovered SandCat.

“This vulnerability successfully bypasses modern process mitigation policies, such as Win32k System call Filtering that is used, among others, in the Microsoft Edge Sandbox and the Win32k Lockdown Policy employed in the Google Chrome Sandbox.”

It leads to gain full remote command execution with the latest browser versions. Kaspersky researchers spotted multiple builds of the exploit for the vulnerability that is compatible with the latest Windows operating system versions.

In order to abuse the vulnerability, the exploit first creates a pipe and create a pair of new objects and number of enlistment objects. The Enlistment object is for the association between the transaction and a resource manager.

Image: Kaspersky

Kaspersky Lab detected this zero-day flaw using following 2 technologies.